Ruby library for dealing with Splunk searches and results using the Splunk REST API.
- Session based authentication to Splunk REST interface
- Create and check on the status of Splunk Jobs
- Natural Ruby methods for interacting with search results (no need to parse XML or JSON or use Ruby Hashes)
gem install splunk-client
Creating and using a client is easy:
require 'rubygems'
require 'splunk-client'
# Create the client
splunk = SplunkClient.new("username", "password", "hostname")
# Create the Search
search = splunk.search("test_search")
# Wait for the Splunk search to complete
search.wait # Blocks until the search returns
#Print the raw XML results
puts search.results
# Use ruby methods for dealing with results:
search.parsedResults.each do |result|
puts result.host + " : " + result.time
end
-
Want to spawn multiple jobs without blocking on each? Use
search.complete?to poll for job status. -
Looking for more or less results? Use
search.results(maxResults)to control how much is returned. (A value of 0 returns all results (this is the default.)) -
Access Splunk fields in results via simple method calls
`result = search.parsedResults` `puts result[0].fieldName`
- Added alias support for raw field
- Added test cases for all Splunk meta fields
-
Added two new objects: SplunkResults and SplunkResult for to support:
-
Accessing Splunk fields via method calls
search.parsedResults.each {|result| puts result.$$FIELD_NAME$$}
WARNING: Compatibility with prior versions will break as SplunkClient no longer returns a sid. It now returns a SplunkJob object.
- Separated SplunkClient and SplunkJob into two separate objects.
- Initial Release
As of 0.5, this software uses Semantic Versioning. Basically, this means that any given minor release number is backwards compatible. Patch releases are just that, and major releases may break compatibility.
If you contribute to this software, and I hope you do, please leave the VERSION file alone. Alternatively, update the VERSION file in a commit on it's own, so that we can cherry-pick around it when merging code.
This software is released under the MIT License (ref: LICENSE)